wanderlustrpg[.]com

Analysis of wanderlustrpg.com shows a high‑risk brand‑impersonation campaign targeting the BLAST brand. The domain was registered through Metaregistrar BV on 17 December 2025 and is currently delegated to Cloudflare name servers dante.ns.cloudflare.com and ophelia.ns.cloudflare.com. DNS resolution points to IP 172.67.194.225, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 identifier, yet Cloudflare returns an HTTP 525 status, indicating a failure to establish a valid SSL handshake.

Detected technologies include Cloudflare’s edge network and HTTP/3 support. The page title returned by the server is “Oathbound Legends,” which does not directly reference the BLAST brand, and no further page content has been publicly disclosed, leaving the exact look‑and‑feel of the impersonation page uncertain. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 / 100, and the domain appears on one security blocklist. PhishDestroy has already listed the domain as blocked, and AlienVault OTX references it in a single threat‑intel pulse.

VirusTotal analysis shows three of ninety‑five scanners flagging the domain, reinforcing the malicious classification. Defenders should immediately add wanderlustrpg.com to URL filtering and DNS‑blocking policies, monitor for any outbound connections to the associated Cloudflare IP, and consider tightening TLS inspection rules to capture the malformed handshake. Continuous re‑scanning is advised to capture any evolution of the payload, and security teams should alert end‑users about potential BLAST‑related phishing attempts that may be routed through this infrastructure.